ComplianceAsCode / ComplianceAsCode/content
xccdf_org.ssgproject.content_value_var_multiple_time_servers unused
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
## Which products and profiles does the rule apply to?
RHEL9
xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server
xccdf_org.ssgproject.content_rule_ntpd_specify_remote_server
Perhaps eventually systemd-datetimed too
## Describe the configuration setting enforced by this rule.
The customization templates include `xccdf_org.ssgproject.content_value_var_multiple_time_servers`, however, this
value doesn't seem to be affecting any rules.
## Why is the configuration security relevant?
The ability to enforce specific trusted timeservers is a benefit to the audit rules.
## How to check the configuration?
Review either the NTPD or chronyd config.
### Is it order dependent? (does it need to be at certain place in the file?)
No
### What is correct and incorrect syntax?
```
pool hotname
```
## How to remediate
Ensure the relevant line/s are in the config.
### Does any command need to be run?
The service may need to be notified about the change to the file.
## Are there going to be other rules like this one in the future? Is it worth creating template? (similar configuration format, similar remediation process...)
Probably since there are similar checks in place for Chrony already.
Having a way to set extra flags like `nts` or other time authentication stuff would be handy.
## Are there any caveats to be considered when testing?
It is specific to the time daemon selected.
## Is the configuration loaded directly by the or is it stored in some intermediate database (similar to dconf)? (We want to edit the lowest level possible, if appropriate)
Text file.
## Is it possible to check / remediate this configuration in offline mode? (scanning containers or offline systems)
This option can be checked in offline mode.
## Please provide security policy references if possible e.g. STIG
Contributor guide
Assessment
This issue has not been assessed yet.